Database Forensic Investigation Based on Table Relationship Analysis Techniques
Dong-Chan Lee, Jaemin Choi, Sangjin Lee · 2009
Most company and organizations manage personnel, account, logistics etc through the database system. The business data stored these database is very important to investigate company dishonest act in the view of the digital forensics. However, it is difficult to extract meaningful data without blueprints because the table inside the database has exceedingly complicated relation and the role of the table and field in the table was so ambiguous. If we don't obtain the database's database or even if we get, but don't understand relationship in the table and meaning of each field, we cannot obtain the significant evidences. Therefore, the investigator should confirm the contents of the database blueprints and check the relationship between the table and hidden table which unsigned blueprints. In this paper, we improve the DBRE (database reverse engineering) process and analyze the table relationship of database and data extraction method in the view of the digital forensics. Moreover we proposed the efficient tool which more easily acquires digital evidences from databases using table relationship and data extraction.